CVE-2026-109618 and CVE-2026-109619
PHP2Shell: the fixed versions, who is exposed and how to patch
PHP2Shell is the name given to two critical PHP vulnerabilities that can let an attacker with no login run code on a web server. The PHP project fixed both on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and says updating is the only complete fix.
Last reviewed against php.net, the NCSC and CISA.
Fixed versions
Which PHP versions are fixed
Find your branch, then compare your full version number with the fixed release. Anything below it on the same branch is vulnerable.
| Branch | Vulnerable | Fixed in | Support status |
|---|---|---|---|
| PHP 8.5 | Below 8.5.12 | 8.5.12 | Supported |
| PHP 8.4 | Below 8.4.27 | 8.4.27 | Supported |
| PHP 8.3 | Below 8.3.36 | 8.3.36 | Supported |
| PHP 8.2 | Below 8.2.35 | 8.2.35 | Supported until 31 December 2026 |
| PHP 8.1, 8.0, 7.4 | All releases | No release from the PHP project | End of life; minimal backports exist |
| PHP 7.3 and older | All releases | None | End of life |
Source: the PHP project's 21 October 2026 security releases and its advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp. On a Linux distribution package the version number can look older than this table and still carry the fix: how to read a backported version. For PHP 7.4, 8.0 and 8.1 the PHP security team has published source-only backports for people who build PHP themselves: what they are and their limits.
Who is exposed
Every PHP install that serves web requests
php.net lists every common way of running PHP for the web: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The NCSC's alert is blunter: organisations using any version of PHP are affected.
The PHP project rates the risk highest for Apache with mod_php, which is where it confirmed remote code execution. Its advisory treats PHP-FPM, FrankenPHP and LiteSpeed as likely susceptible too, so a different server setup is not a reason to wait.
Easy to miss
- Products with PHP inside. Appliances, control panels and packaged applications often ship their own PHP. The NCSC asks organisations to watch for vendor updates; NCSC-NL keeps an inventory of affected products.
- Staging and forgotten sites. Old microsites, test copies and development servers left reachable from the internet are as exposed as the main site.
- Containers. A container built from a PHP image keeps the PHP version it was built with until it is rebuilt. The official Docker image's apache variants run PHP as mod_php, the setup where the PHP project confirmed code execution; php.net's own guidance is not to use mod_php for new installations.
- Unsupported branches. PHP 8.1 and older get no fix from the PHP project at all.
The vulnerabilities
The two CVEs, and the advisories since
The PHP project rates both flaws Critical, with a CVSS v4.0 base score of 9.2. Other organisations have scored them differently, so check which scorer a quoted number comes from.
CVE-2026-109618: remote code execution through out-of-memory handling
When PHP runs out of memory part way through a request, it can abandon that request while its internal data is only partly set up. The clean-up that follows may then trust data that was never valid. A crafted upload or form submission can push a request into that state while staying within PHP's apparent limits, and the PHP project says the result can be remote code execution.
CVE-2026-109619: remote code execution through stale state between requests
A PHP worker keeps some state between requests. A fatal error can
leave that state pointing at memory that has already been freed,
and a later request handled by the same worker can then use it.
The PHP project confirmed two routes: PHP 8.5's
fatal_error_backtraces feature, and session upload
progress, which it validated against both mod_php and PHP-FPM.
23 October 2026: CVE-2026-115560, session upload progress
An informational advisory linked to CVE-2026-109619. It can only
occur under an unusual combination: an application that sets
session.serialize_handler to php_binary
or php_serialize, then switches it back to
php with ini_set() before calling
session_start(). php.net suggests turning session
upload progress off until its next regular bugfix release, which
will carry the full advisory. Applications that never change the
serialize handler at runtime can keep the feature on.
26 October 2026: Windows builds and CVE-2026-111497
New Windows packages (8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1) update the bundled Brotli library to fix an out-of-bounds write. The PHP runtime versions are unchanged. On Windows the flaw is reachable through the cURL extension when automatic HTTP response decompression is switched on, which cURL leaves off by default.
Exploitation and alerts
Known to be exploited
The UK's NCSC and the US CISA both issued alerts on 21 October 2026, the day the fixes shipped. On 26 October 2026 CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalogue. CISA's guidance is to take PHP systems offline if they cannot be updated immediately, or if they run PHP 8.1 or earlier.
The full PHP2Shell timelineWhat to do
Five steps, in the order the NCSC sets out
-
Step 1
Find every PHP installation
Start with the systems the internet can reach. The NCSC asks organisations not to limit the search to outdated versions: every PHP install serving web requests is in scope, including appliances and products that bundle PHP.
How to check your PHP version -
Step 2
Update to a fixed release
Move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your vendor's fixed package, then restart PHP so old worker processes stop serving requests.
How to update PHP -
Step 3
Apply the interim settings if you cannot update yet
The PHP project has published configuration changes that reduce the risk. They are partial: php.net is explicit that updating is the only complete fix.
The interim settings, below -
Step 4
Take it offline if neither is possible
If you cannot update or apply the settings, or doing so would take too long, the NCSC says to consider taking the system offline until it can be fully mitigated.
Should I take my website offline? -
Step 5
Check for compromise
Both flaws are on CISA's Known Exploited Vulnerabilities catalogue. A server that ran a vulnerable build on the internet should be checked for backdoors, even after it is patched.
Has your PHP site been compromised?
If you cannot update today
The interim settings, and their limits
The PHP project's advisories list configuration changes that reduce
the risk while you arrange the update. Apply them in
php.ini or the PHP-FPM pool configuration, not with
ini_set(), and restart every PHP worker afterwards.
session.upload_progress.enabled=0removes a confirmed attack route. The advisory recommends keeping it off even after patching if you do not use the feature.- On PHP 8.5,
fatal_error_backtraces=0removes the route behind the confirmed mod_php attack, though not every route. - A conservative
post_max_size, request-size limits enforced in front of PHP, and blocking multipart requests at the web server or firewall where your site does not use uploads. memory_limit=-1is listed as a configuration mitigation, but removing the memory limit has its own side effects; read the advisory before using it on a production server.
In the PHP project's own words, updating to a release containing the patch is "the only complete mitigation". If the update is more than a few days away, use the risk calculator to decide whether the site should stay online in the meantime.
Quick answers
PHP2Shell questions, answered
Am I affected by PHP2Shell?
Almost certainly, if you run PHP to serve web pages and have not updated since 21 October 2026. php.net says the flaws affect all PHP installations serving web requests, and the NCSC says organisations using any version of PHP are affected. You are fixed only if you run 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later on the same branch, or a vendor package your supplier confirms carries the fix.
Which PHP versions are safe?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and any later release on those branches. PHP 8.1 and older get no fix from the PHP project. Linux distributions often backport the fix without changing the version number, so on a distribution package check your vendor's security tracker rather than the number.
Can I protect my site without updating PHP?
Only partly. The PHP project lists interim settings that reduce the risk, starting with session.upload_progress.enabled=0, but its advisory states that updating is the only complete mitigation. Treat the settings as a stopgap measured in days, not a fix.
Why is it called PHP2Shell?
PHP2Shell is the name the researchers who found the flaws gave them when they published on 21 October 2026. It reflects what a successful attack can give an attacker: a shell, the ability to run commands, on the web server. The official identifiers are CVE-2026-109618 and CVE-2026-109619.
Is PHP2Shell the same as the WordPress Click2Shell flaw?
No. Click2Shell is a separate WordPress vulnerability that was fixed in WordPress 7.1.1 in September 2026, and CVE-2026-87902 is another WordPress flaw, fixed in WordPress 7.1.2 on 22 September 2026. PHP2Shell is in PHP itself, beneath WordPress. Updating WordPress does not update PHP, so a WordPress site needs both kinds of fix.
Do I need to check for compromise if I have already patched?
Yes, if the server was reachable from the internet before you patched. Patching closes the hole but removes nothing an attacker may have left behind. CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalogue on 26 October 2026.
Know your exposure
Find every PHP server you run
Patching the server you know about is the easy part. A vulnerability scan finds the forgotten staging site, the old microsite and the appliance with PHP inside, then tells you which ones are still exposed.